DNS traffic for internal domains is routed through Private Access

Overview

When you enable the Private Access profile in Global Secure Access but don’t publish port 53 (UDP/TCP) in application segments or configure private DNS suffixes, the Global Secure Access client can’t route DNS queries for internal domain names through the tunnel. As a result, DNS queries for internal FQDNs go to the local resolver on the device, which has no knowledge of internal zones.

Without this configuration:

• FQDN-based application segments fail to match traffic because the client can’t resolve internal host names to IP addresses.
• Threat actors operating on the same local network as the remote user can observe unencrypted DNS queries, map internal resource names, and identify targets for later stages of an attack.
• The client might fall back to direct connections that bypass Conditional Access and security profile enforcement applied through Global Secure Access.

Remediation

• Configure private DNS suffixes for Quick Access or per-app access so DNS queries for internal domains go through Global Secure Access.
• Configure per-app access with application segments that include port 53 (UDP/TCP) to an internal DNS server.
• Learn about Microsoft Entra Private Access in Global Secure Access.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Private Access
Product	Entra ID
Feature	Global Secure Access
Area	Infrastructure hardening
ATT&CK	T1557.001 Name Resolution Poisoning and SMB Relay
Licence	AAD_PREMIUM, Entra_Premium_Private_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.